I have a network so configured: a router and a RPI that acts as wifi access point, dhcp and dns servers, firewall and gateway. The RPI is also connected with a OpenVpn client to a payed VPN service (NordVPN) so all the WiFi clients use the VPN connection.
I'm trying to create a private VPN so I can connect to the RPI also from outside. I run a VPN server on the RPI for this use. NordVPN does not provide port forwarding so I cannot connect to the RPI through the NordVPN IP address and I'm tryint to reach the RPI from the ISP public IP. I configured the port forwarding from the router to the RPI local IP address.
I'm able to connect with the private VPN to the RPI when the NordVPN connection is off but I cannot connect when the NordVPN connection is running.
I read the problem is the routing so I configured it and the maximum result reached is that I can do SSH from outside to the RPI when the NordVPN connection is runnging but I'm not able to connect with my OpenVPN client (with running NordVPN). The problem is that client and server do not complete the handshake. The server receive the first packet (I thing the firewall could be ok) but it is not able to send the reply (or it send through the wrong route). But it seems this problem there is not with SSH connection because it works from out (and I guess the server reply to the client handshake).
Other info:
- 192.168.4.0/24 is the local client's network (rpi's wifi)
- 192.168.1.0/24 is the local router's network
- 192.168.1.1 is the router
- 192.168.1.117 is the RPI eht0
- 10.8.0.0/16 is the NordVPN tun0 network
- the payed VPN runs on standard OpenVPN port but the private VPN runs on different port
First, following here, I tried to forward from router to 192.168.1.117 with these routes on RPI.
ip rule add fwmark 65 table novpn
ip route add default via 192.168.1.1 dev eth0 table novpn
iptables -t mangle -A OUTPUT -p udp --sport 1234567 -j MARK --set-mark 65
In this case I was able to connect via private VPN only without NordVPN running.
Second, following here, I created a virtual eth0 interface (192.168.1.118). I forwarded from router to this new address and I configured the routes like this:
ip addr add 192.168.1.118 dev eth0:0
ip rule add from 192.168.1.118 table 1234
ip route add default via 192.168.1.1 dev eth0:0 table 1234
So I can connect via SSH from outside also when NordVPN connections is active but when I launch the private VPN client it is not able to complete handshake with these errors:
XXX.XXX.XXX.XXX:53347 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:53347, sid=5138c564 319ce197
Dec 08 23:02:55 rpi ovpn-server[19950]: XXX.XXX.XXX.XXX:53347 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Dec 08 23:02:55 rpi ovpn-server[19950]: XXX.XXX.XXX.XXX:53347 TLS Error: TLS handshake failed
I am on this problem since 2 weeks and I have definetly no other idea. Maybe someone could help me?
Thanks in advance.
PS: I do not write my iptables rules because they are a lot.
UPDATE: this is my server.conf
dev tun
proto udp
port PORT
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/XXX.crt
key /etc/openvpn/easy-rsa/pki/private/XXX.key
dh none
topology subnet
server 10.35.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io
and this is the private client conf
client
dev tun
proto udp
remote ISP_IP PORT
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-version-min 1.2
verify-x509-name XXX name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3
These are my routes:
$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
10.35.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
128.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0
NORDVPN_GW 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0
UPDATE 2:
The network topology is:
WIFI LAN CLIENTS (192.168.4.X) -> RPI (eth0 192.168.1.117, wlan0 192.168.4.1, tun0 NordVpn client 10.8.0.0/16, tun1 10.35.0.1 OpenVpn server) -> ROUTER (192.168.1.1) -> INTERNET
What I'd like to do:
OPENVPN CLIENT (10.35.0.2) -> INTERNET -> ROUTER -> RPI
